Go to content

1. Background and problem statement

Images: Federico Beccari and Michael Schreiber / unsplash.com
The Nordic and Baltic countries – while internationally recognised for their digital leadership – continue to face disparities in access to high-speed internet connectivity. These inequalities are most pronounced in the region’s numerous sparsely populated and remote rural areas, including Arctic and sub-Arctic communities, archipelagos and certain cross-border regions. In these locations, residents and businesses often experience limited broadband access, poor mobile coverage (especially 5G) and a lack of long-term, competitive infrastructure investment (European Commission, 2025a). These connectivity gaps not only hinder access to essential public services like healthcare, education and emergency response, but also limit regional economic potential and can be considered a key contributor to the widening urban-rural digital divide (de Jesus & Melander, 2024).
The Gigabit Infrastructure Act (GIA) was introduced by the European Commission in 2024, replacing the Broadband Cost Reduction Directive (BCRD) from 2014. Implementation of the BCRD had been inconsistent across Member States and no longer met the increasing demand for fast and reliable digital connectivity in Europe (European Commission, 2025b). The goal of the GIA is to promote universal access to very high-capacity networks (VHCNs), in line with the connectivity targets set out under the EU’s Digital Decade initiative. These targets specify that by 2030, all EU households should have access to a fixed gigabit network and all populated areas should be covered by 5G (European Commission, 2025c). However, affordability issues are likely to persist. As seen in peri-urban and rural areas where gigabit connections are availably but subscription prices remain prohibitive, economic barriers may continue to limit effective access (OECD, 2024).
The Digital Networks Act (DNA), adopted in January 2026, modernises the EU’s rules for digital connectivity. It aims to reduce market fragmentation, encourage investment and strengthen the resilience of Europe’s communications infrastructure. The Act aims to create a single, harmonised framework that supports cross-border operations, simplifies authorisations and streamlines regulation. Key measures include a “Single Passport” for operators, clearer rules for innovative digital services, an EU‑level preparedness plan for network resilience and improved conditions for spectrum use. Overall, it is designed to foster a more competitive, innovative and secure digital ecosystem across the Union (European Commission, 2026).
Several instruments introduced under the GIA are aimed at simplifying infrastructure rollout, encouraging private investment and ensuring transparency in deployment (European Commission, 2025b), see Fact Box 1. For example, a telecommunications company deploying fibre can leverage existing infrastructure under the GIA, such as water ducts, instead of initiating new construction works. Essential information about current infrastructure and planned civil works will be made available through digitally accessible "Single Information Points " (SIP) in each country to further facilitate this process. The GIA will further enhance digital accessibility by streamlining and digitising permits for rollout activities, requiring authorities to meet strict deadlines to enable quicker deployment and reduced costs (European Commission, 2025b).
The regulation is especially relevant to the Nordic-Baltic region, where connectivity challenges stemming from regional physical conditions intersect with broader development objectives, such as the goal of the Nordic and Baltic Ministers of Digitalisation for the region to become the most digitally integrated in the world by 2030 (Nordic Council of Ministers, 2024b). The simplified deployment of high-speed digital connectivity in underserved areas will facilitate more affordable and efficient access for Internet Service Providers, potentially enhancing connectivity in rural and economically less prioritised parts of the region. The GIA’s emphasis on transparency aims to enhance trans-border collaboration and knowledge-sharing practices, further supporting the rollout process in rural areas while fostering innovation. The harmonised regulatory framework, including Single Information Points, for instance, will help multinational telecom companies and cross-border consortia to plan, build and operate more seamlessly across borders. The regulation also provides for regular reporting, monitoring and benchmarking on an EU level to ensure continuous improvements and mutual learning practices across the Member States (The European Parliament & the Council of the European Union, 2024).
Fact Box 1: The Gigabit Infrastructure Act (GIA)
Implementation timeline
Entered into force: 11 May 2024
Fully applicable: November 2025
Purpose
To help achieve the European Union’s 2030 Digital Decade connectivity goals by facilitating the rollout of very high-capacity networks, ensuring EU-wide access to fast gigabit connectivity and high-speed mobile data by 2030.
Measures
Render the rollout of gigabit networks simpler, cheaper and faster by
1. reducing bureaucratic hurdles;
2. encouraging the shared use of existing infrastructure;
3. improving the coordination of public works to install fibre; and
4. ensuring that buildings are equipped with high-speed internet.
Expected impact
-  Faster and cheaper network deployment
-  Reduction in greenhouse gas emissions
-  More equal access to fast, stable and affordable internet, generating numerous benefits for citizens and companies, including in terms of digital innovation and inclusion
Source: European Commission, 2025b.
At the same time, the GIA's objectives are being implemented in a region marked by heightened geopolitical sensitivities. In 2024 and 2025, several incidents involving damage to undersea cables connecting the Nordic and Baltic countries in the Baltic Sea raised suspicions of sabotage (Reuters, 2024; SVT Nyheter, 2025). These events highlighted not only the cascading and transboundary effects of attacks on critical infrastructure but also intensified discussions concerning the resilience and protection of such infrastructure, with particular emphasis on telecommunication links between these nations. In addition, incidents may arise not only from deliberate acts of sabotage but also as a result of accidents and wear-and-tear over time.
The increasing risk of hybrid and cyber threats indicates that enhancement of digital connectivity and the increasing reliance on digital services in the Nordic and Baltic countries also introduce new vulnerabilities and hence significant national security considerations. While past events have prompted increased cooperation among the countries, additional measures, including legal ones, will be necessary to address risks in a sustainable and harmonised manner (Aula et al., 2020; Fjäder & Schalin, 2024).
One key instrument in this regard is the latest Network and Information Security Directive (NIS2), which strengthens cybersecurity protocols for essential infrastructures (European Commission, 2025d). While primarily complementing the GIA, certain aspects require a balancing act by the Member States, particularly regarding the GIA’s emphasis on transparency and openness and the NIS2’s focus on risk containment. Although these two regulatory regimes share an overarching purpose, they can create ambiguities and procedural complexities, posing challenges for maintaining and fostering transparency and cross-border innovation in the context of increased security risks (European Commission, 2024a).
Fact Box 2: The Network and Information Security Directive (NIS2)
Implementation timeline
Entered into force: January 2023
Implementation by October 2024 (however, as of May 2025, transposition is still ongoing in 19 Member States)
Purpose
To enhance cybersecurity resilience across the European Union.
Measures
Key NIS2 measures include:
1. expanding the scope of essential and important entities required to comply with the NIS2;
2. imposing higher demands on cybersecurity standards, including technical, operational and organisational measures, as well as managerial oversight and training;
3. mandatory incident reporting to the respective national competent authority;
4. granting national authorities greater powers to audit, investigate and sanction entities that fail to comply; and
5. deepening EU-level cooperation on incident response, guidance and threat intelligence.
Expected impact
-  Improved incident response
-  Increased cyber resilience among businesses and entities critical to the economy and society
-  Harmonised standards
Source: European Commission, 2025e; The European Parliament & the Council of the European Union, 2022.
These challenges particularly impact the municipalities and local operators responsible for implementation (Sveriges Kommuner och Regioner, 2023b). Under the GIA, municipalities bear significant responsibility for enabling the faster rollout of improved connectivity (European Commission, 2025b). It has been noted that smaller or more rural municipalities may face additional strain due to their limited technical and legal resources for ensuring compliance, while simultaneously attracting new infrastructure investments (Sveriges Riksdag, 2023). Consequently, targeted policy coordination, guidance and support are necessary to realise the transformative potential of the GIA in politically complex areas where it is most required.